CVE-2026-36670: A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9

Synopsis

A time-based blind SQL injection vulnerability affects the alias_management module of OpenSIPS Control Panel (opensips-cp) in versions prior to 9.3.3. The flaw is reachable over the network by any authenticated user with a low-privilege account, exploiting the 'table' GET parameter in alias_management.php to inject arbitrary SQL commands. Successful exploitation gives an attacker full read, write, and denial-of-service control over the underlying database. No upstream fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint in alias_management.php is exposed over the network, so an attacker must be able to reach the OpenSIPS Control Panel service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; the injected 'table' parameter is processed without further privilege checks after login.

• Victim interactionNot required

  The attacker submits a crafted GET request directly; no action from another user or administrator is needed.

• Attack complexityDetail

  Exploit complexity is low: the injection point is reliably reachable with no race conditions or special environmental conditions required.

Blast Radius

• An attacker reads all data stored in the database, including SIP alias records, user credentials, and any session or configuration data persisted by opensips-cp.
• An attacker modifies or deletes persisted database rows, allowing manipulation of SIP routing tables, alias mappings, and user account data.
• An attacker executes resource-exhausting SQL operations that crash or severely degrade database availability, taking down SIP routing dependent on the control panel.
• An attacker leverages database-level write primitives to pivot further into the host system if the database user has file-write or command-execution privileges.